Privacy Notice
GEXCAP, INC. ("we") operates the margospartners.com platform. This notice explains what personal data we collect through it, why, who else sees it, and what you can do about it.
Last updated: 22 October 2026. The platform is a beta release; see the Terms & Conditions.
1. Who is responsible
GEXCAP, INC., a company incorporated in the United States, is the controller of the personal data you give to this platform. We are established outside the European Union and we offer this service to people in the EU, so the General Data Protection Regulation applies to us.
Representative in the European Union. Article 27 of the GDPR requires a controller established outside the Union, offering services to people inside it, to designate a representative in a member state in writing. Our designation is being put in place; the representative's name and address will be published in this section as soon as it is, and this notice will carry the date of that change.
In the meantime, and afterwards, you may raise any data protection matter with us directly at office@margospartners.com and we will answer within one month. None of the rights in section 8 depends on that designation, and none of them is suspended while it is being made.
We keep a technical service office in Malta which maintains this website. It performs no client work and takes no decisions about your data.
2. What we collect
What you tell the assistant. The conversation itself, and the details you enter in it — your situation, the service you are asking about, and the contact details you give us.
Files you upload. Documents you attach to a conversation, and their metadata.
Account data, where you create one: your email address, sign-in credentials and conversation history.
Records of contact: messages, enquiries, and any invoices or payments.
Technical logs: requests to the service, errors, and administrative actions, kept for security and to make the platform work.
Website measurement. Where enabled, we count arrivals. This is done without cookies and without storing your IP address: a visitor is distinguished within a single day by a one-way, salted digest that cannot be reversed and that does not identify the same person on a later day. We can count how many people came, from where, on what device and in what language. We cannot follow an individual over time.
Steps taken on the site. In the same way — no cookies, no stored IP address, a one-way digest that lasts one day — we count which steps are taken on the site: a page opened, a chat started, a message sent, a tool used, the details card shown or sent, a request form sent, a partner firm responding or being chosen. We record the language, the page the visit began on and the service concerned. We also record how the visit began: only the name of the website that sent the visitor (for example Google), or that none did, and whether it began with a click on one of our adverts (not which one) — never the address of the page the visitor came from or what they searched for. We use the totals to see where visitors give up and what to improve; a weekly summary is e-mailed to our office, and the events are deleted after 400 days.
Advertising measurement (Google Ads). To see which of our adverts lead to an enquiry we use Google Ads conversion measurement (tag AW-18447388218) with Google Consent Mode v2. Nothing is sent to Google until you choose. The Google tag is not loaded when you arrive. If you press Accept in the cookie window, the tag is loaded and Consent Mode changes to granted for advertising storage, advertising user data, ad personalisation and analytics storage; Google may then set cookies in your browser and receives the address of the page you are on, your browser details and the fact that you sent an enquiry, and it processes them under its own terms. If you press Decline or close the window, the Google tag is not loaded, nothing is sent to Google and no advertising cookie is set. You can change your choice at any time under Cookie settings at the top of the Terms & Conditions page; choosing Decline there stops any further sending and clears the Google cookies this site can reach. The choice is kept in your browser (key mp-consent). The legal basis is your consent (Article 6(1)(a) GDPR; Article 5(3) of the ePrivacy Directive).
We do not ask for special category data — health, beliefs, biometrics — and you should not put it into the assistant. If your matter requires it, give it to the law firm once it is engaged, not to this platform.
Data a partner law firm holds about its clients. A partner firm using its portal may upload its own clients' details and documents — including identity documents needed to prepare official forms — and may open client accounts for them. That data is processed on the firm's instructions: the firm is the controller, and we act as its processor under the agreement between us. It is not collected by the public assistant, and questions about it go to the firm. Calls a partner firm makes through the API are counted per key for billing; the count records which key called what and when, not the content of the call.
3. Why, and on what legal basis
| What | Why | Basis |
|---|---|---|
| Your enquiry and conversation | To understand what you need and prepare a summary | Steps at your request before a contract (Art. 6(1)(b)) |
| Passing your enquiry to a law firm | To get you to somebody who can act | Steps at your request; our legitimate interest in operating an introduction service (Art. 6(1)(b), (f)) |
| Account and history | To let you return to your own conversations | Contract (Art. 6(1)(b)) |
| Security and technical logs | To keep the platform working and safe | Legitimate interest (Art. 6(1)(f)) |
| Marketing about the services here | To tell you about services you may want | Consent, or legitimate interest for a similar existing enquiry (Art. 6(1)(a), (f)) |
| Keeping records of what was said | To answer complaints and meet legal obligations | Legal obligation and legitimate interest (Art. 6(1)(c), (f)) |
| Advertising measurement (Google Ads) | To see which adverts lead to an enquiry | Consent (Art. 6(1)(a)); ePrivacy Art. 5(3) |
4. Automated processing, and what it is not
Your messages, and the documents you attach to a conversation, are sent to an automated language model to generate a reply, a summary or a draft; a photograph or a scan of a document is read by the model to take its text out. Where a third-party model provider operates that model, your content is transmitted to that provider under its terms.
This is not automated decision-making that produces legal effects for you. The assistant does not decide anything about you: it does not accept or refuse you as a client, does not price your matter bindingly, and does not decide whether a firm takes your case. A human at an independent law firm makes that decision.
If you would rather your material were not processed this way, do not put it in the assistant — write to us instead.
5. Who else sees your data
The Collaborating Firm. When your enquiry is passed to an independent Maltese law firm, that firm receives the enquiry and the summary so it can consider your matter. From that point the firm is a controller in its own right, under its own privacy notice and its own professional duty of confidentiality. We do not control what it does with your data and we are not responsible for it.
Our processors, acting only on our instructions: hosting, model providers, email delivery, and payment providers where you pay through the platform. We do not receive or store card details.
Authorities, where the law requires it.
We do not sell personal data, and we do not share it with data brokers. The only advertising network we use is Google Ads, for conversion measurement, and only if you accept it (section 2).
6. Transfers outside the EEA
Operating this platform involves transferring personal data to the United States, and possibly to other countries outside the European Economic Area, including through the providers named above.
Those transfers are made on a lawful basis under Chapter V of the GDPR — either an adequacy decision covering the recipient, or the European Commission's Standard Contractual Clauses together with the supplementary measures those clauses require. Which of the two applies depends on the recipient. We will name the mechanism for any given transfer, and give you a copy of the safeguards, on request at office@margospartners.com.
Where a transfer would have no lawful basis, it is not made. Personal data you give this platform is not transferred outside the EEA except as described in this section.
7. How long we keep it
Enquiries and conversations, and the documents generated from them, for as long as needed to deal with your matter and afterwards for as long as complaints and limitation periods require. Account data for as long as the account exists, and a short period afterwards. Technical and security logs for a short retention period. Marketing consent records for as long as we rely on the consent, and afterwards as proof that it was given.
Data a partner firm holds about its clients is kept for as long as the firm's account is open, and afterwards for as long as complaints and limitation periods require; the firm can ask for it to be deleted earlier, and we do so where no legal requirement prevents it.
During the beta, data may be deleted earlier than any of this — see clause B.3 of the Terms. Keep your own copy of anything you need.
8. Your rights
You have the right to ask us for access to your personal data, correction of it, erasure, restriction of processing, and portability, and to object to processing based on legitimate interest. Where processing rests on consent, you may withdraw it at any time, and withdrawing costs nothing and does not affect what was done before.
Write to office@margospartners.com. We answer within one month. We may need to confirm who you are first.
If you are unhappy with how we handle it, you may complain to a supervisory authority — in Malta, the Information and Data Protection Commissioner (idpc.org.mt) — or to the authority where you live or work.
Rights about a matter a law firm is handling for you should be exercised against that firm, which holds that data as its own controller.
9. Security, and breaches
We keep the platform behind access control, encrypt data in transit, and log administrative actions. No system is perfect. Where a personal data breach is likely to result in a risk to your rights, we notify the competent supervisory authority within 72 hours of becoming aware of it, and we tell you directly where the risk to you is high.
10. Changes
We may update this notice. The version in force is the one on this page, and the date at the top is when it last changed.
11. Contact
GEXCAP, INC., operator of the margospartners.com platform — office@margospartners.com